The Packets, Life and everything
Some notes on 100 Gbit/s Ethernet, TLS, kTLS and modern NIC offloading. In TCP Bandwidth, I looked at why a fast Ethernet interface does not automatically result in a fast TCP connection. RTT, the bandwidth-delay product, TCP windows, congestion control, packet loss and host processing all have to line up before a connection can approach …
Continue reading "100 Gbit/s TLS: When the NIC Starts Doing More Than Networking"
Some notes on TCP bandwidth. Maybe you've seen it before: a server has a 10 Gbps interface, the path is not congested, and a local test reaches line rate — but a single TCP transfer across a WAN or hybrid-cloud path stops at a fraction of the expected speed. The link is fast, yet the …
Maybe you've seen it before: overall link utilization looks fine, but some flows are noticeably slower than others on paths that should be identical. One common — and easy to miss — cause is IP fragmentation interacting badly with Equal-Cost Multipath (ECMP) or Link Aggregation Group (LAG) load balancing. The Symptom A set of flows …
Continue reading "Performance Impact of IP Fragmentation and Load Balancing"
In Diagnosing a Slow git clone Over SSH With Packet Timing I binned a packet capture into per-minute byte counts and found a 48-minute SSH session that was really 34 minutes of near-silence followed by ~13 minutes of bulk transfer. That post stopped at the diagnosis: the server was building the pack, the network was …
Continue reading "Git Pack Housekeeping: What 34 Minutes of Silence Actually Cost"
I found Diagnosing a Slow git clone Over SSH With Packet Timing sitting finished in the drafts folder this week — written, edited, references and all, dated 2018-11-21. Nothing wrong with it. Nobody was blocking it. It just never went out. The post is about a specific failure mode: a session that looks alive on …
Continue reading "The Slowest git clone in My Drafts Folder"
In FortiGate - High CPU and Memory load the root cause traced back to sessions that never get hardware-offloaded to the NPU/SPU — DNS and ICMP being the two protocols of interest, since they never leave the CPU path regardless of volume. This note is the workflow for actually finding which host is generating that non-offloaded load, and where it's …
Continue reading "FortiGate – Identifying Non-Offloaded Sessions per Host"
Encryption is sold as an unambiguous good: encrypt everything, everywhere, and you're safer. At first glance it does bring privacy — nobody in the middle can read your traffic, your disk, your backup. But privacy and security are not the same goal, and they don't always move in the same direction. Sometimes gaining one costs …
Continue reading "A Case for Privacy and Security — or Why Encryption Can Lower Your Security"
The need to contain software and systems is likened to containing diseases like Ebola and COVID due to their potential threats. Examples of security risks include repojacking, Docker malware, and cloud breaches. How do we deal with Software?Security, Safety, and PrivacySo how do we handle this with computers?Can a computer secure/defend itself?What can we do?2026 …
Continue reading "Full Containment – Do we have to treat software like Ebola?"
Entra ID OIDC-based SSOStep 1: Register the Application in Entra IDStep 2: Create a Client SecretStep 3: Configure API PermissionsStep 4: Configure Keycloak to use Entra IDStep 5: Configure Keycloak for NextcloudStep 6: Configure Nextcloud Common PitfallsEvaluating the Client IP via X-Forwarded-ForDiscovery URLsHow to Fetch the DocumentWith curlLinks Entra ID OIDC-based SSO Step 1: Register …